Description

Jenkins Extensive Testing Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

Remediation

References

https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1432

Related Vulnerabilities

CVE-2020-13956 Vulnerability in maven package org.apache.httpcomponents:httpclient

CVE-2023-34047 Vulnerability in maven package org.springframework.graphql:spring-graphql

CVE-2022-34199 Vulnerability in maven package com.convertigo.jenkins.plugins:convertigo-mobile-platform

CVE-2017-1000355 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2021-29425 Vulnerability in maven package commons-io:commons-io

Severity

Critical

Classification

CWE-522 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory